ACS to ISE migration

Has anyone successfully migrated from ACS to ISE especially with WLAN or WiFi users?
If you have, please share any information.

I have done a few of those. I have never tried using the migration tool but instead have always created configurations from scratch. Basically, anything Radius related will migrate just fine. The one major thing that ISE won't support is TACACS+ but that is also coming in a future release. For more info check this doc:
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/migration_guide/ise_migration_guide/ise_mig_overview.html\
Thank you for rating helpful posts!

Similar Messages

Cisco ACS to ISE Migration Tool

HI all.
I'm gtrying to migrate in our LAB ACS 5.3 to ISE 1.2 using the migration tool and i take this error:
D:\migTool>migration.bat
log4j:WARN No such property [encoding] in com.cisco.acs.positron.migration.utils.Log4jTextAreaAppender.
INFO [main] MigrationApplicationDriver.main:56: Starting Application, in the main method......
Exception in thread "main" org.springframework.beans.factory.BeanDefinitionStoreException: Failed to read candidate component class: file [D:\migTool\bin\com\cisco\acs\positron\migra
tion\gui\components\treetable\JTreeTable.class]; nested exception is java.lang.ArrayIndexOutOfBoundsException: 3145
        at org.springframework.context.annotation.ClassPathScanningCandidateComponentProvider.findCandidateComponents(ClassPathScanningCandidateComponentProvider.java:237)
        at com.cisco.acs.positron.migration.MigrationApplicationDriver.main(MigrationApplicationDriver.java:61)
Caused by: java.lang.ArrayIndexOutOfBoundsException: 3145
        at org.springframework.asm.ClassReader.readClass(Unknown Source)
        at org.springframework.asm.ClassReader.accept(Unknown Source)
        at org.springframework.asm.ClassReader.accept(Unknown Source)
        at org.springframework.core.type.classreading.SimpleMetadataReader.<init>(SimpleMetadataReader.java:54)
        at org.springframework.core.type.classreading.SimpleMetadataReaderFactory.getMetadataReader(SimpleMetadataReaderFactory.java:80)
        at org.springframework.core.type.classreading.CachingMetadataReaderFactory.getMetadataReader(CachingMetadataReaderFactory.java:82)
        at org.springframework.core.type.classreading.SimpleMetadataReaderFactory.getMetadataReader(SimpleMetadataReaderFactory.java:76)
        at org.springframework.core.type.filter.AbstractTypeHierarchyTraversingFilter.match(AbstractTypeHierarchyTraversingFilter.java:105)
        at org.springframework.core.type.filter.AbstractTypeHierarchyTraversingFilter.match(AbstractTypeHierarchyTraversingFilter.java:76)
        at org.springframework.context.annotation.ClassPathScanningCandidateComponentProvider.isCandidateComponent(ClassPathScanningCandidateComponentProvider.java:280)
        at org.springframework.context.annotation.ClassPathScanningCandidateComponentProvider.findCandidateComponents(ClassPathScanningCandidateComponentProvider.java:214)

Migration Tool Installation Guidelines:
http://www.cisco.com/c/en/us/td/docs/security/ise/1-1/migration_guide/ise_migration_guide/ise_mig_install.pdf

REST API ACS vs ISE

Hi all
We are currently using ACS for wireless authentication. Guests register over an external Sharepoint webpage. The REST API is used to create and later delete these temporary users in ACS.
Now we want to migrate to ISE. In contrast to ACS, the ISE REST API seems to have no CRUD (Create, Read, Update and Delete) capabilities for Users. The ISE internal guest portal at the other hand we don't want to use.
Is there any other possibility to create Users in ISE from an external Application ?
Thanks Thomas

Hi Thomas,
Cisco ISE allows you to view, create, modify, duplicate, delete, change the status, import, export, or search for attributes of Cisco ISE users.
ISE also allows you to import user data in the form of a csv file into its internal database. Instead of entering user accounts manually into Cisco ISE, you can import them.
Following are the steps,
Step 1 Choose Administration > Identity Management > Identities > Users.
Step 2 Click Import to import users from a comma-delimited text file.
Tip (Optional) If you do not have a comma-delimited text file, click Generate a Template to create this type of file.
Step 3 In the File text box, enter the filename containing the users to import, or click Browse and navigate to the location where the file resides.
Step 4 Check the Create new user(s) and update existing user(s) with new data check boxes if you want to both create new users and update existing users.
Step 5 Click Save to save your changes to the Cisco ISE internal database.
http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_man_id_stores.html#wp1407470

ACS to ISE config issues

Hi,
Im trying to migrate VPNS from ACS to ISE but i cannot quite get used to the ISE.
Below is a picture of my Authentication rule id like replicating on ISE but so far i have had no joy. Any points would be greatly received.
If the network source IP is trusted Rule 1 is hit and ISS is just use AD
If the network source IP is untrusted Rule 2 is hit and ISS is just use OTP Then AD
Im not 100% on the authorisation aspect either.
I think im want something along the lines of Ad:Group/x/x/x/x and TunnelGroup xxx = Permit/Apply ACL else Deny
I can pass authentiation from the ASA to ISE, one thing i have noticed in the aaa report, in the AV pairs the tunnel group name is not listed.
Many thanks in advance
S

Hi
FYI
Cisco Secure ACS and Cisco ISE exist on different hardware platforms and have different operating systems, databases, and information models. Therefore, you cannot perform a standard upgrade from Cisco Secure ACS to Cisco ISE. Instead, the Cisco Secure ACS to Cisco ISE Migration Tool reads data from Cisco Secure ACS and creates corresponding data in Cisco ISE.
For migrating the policies, and all other information, please visit the following link particularly the chapter 3,4,5:
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/migration_guide/ise_migration_guide/ise_mig_preface.html

Can i configure a network with ACS and ISE?

I have both acs and ise, how do i integrate these appliance to work togheter?
Thanks

ISE does not interoperate with Cisco Secure ACS deployments. The Cisco Identity Services Engine can work in tandem with Cisco NAC Manager to provide the same profiling service as the NAC Profiler, which has reached end-of-sale status.
Existing Cisco Secure ACS customers using network access can easily migrate to the Cisco Identity Services Engine platform using migration part numbers and tools. However, existing Cisco Secure ACS customers using TACACS functions will not be able to migrate to the current version of ISE for network device identity management which is often acceptable for customers who prefer to keep user and network identity on separate systems.

Replacing ACS with ISE

What is required to replace ACS with ISE in simple terms?
I am looking to basically authenticate wired and wireless access against the local/AD) user database via Cisco kit
I am thinking all I need is the BASE (perpetual) license rather than the advanced/wireless licenses
Is there a limit to how many devices or users the base can deal with in its simplest form.
I would also like to be able to push out a splash screen for wireless users during authentication. Can this be done just with the ISE Base License alone for a wireless solution (via WLC with LWAPS or Autonomous APs)
thanks
dave

yes you can authenticate the user using the ISE and but you need a advance license if you want to use both wire and wireless here is small table to help you understand the license requirements also the max. devices support depends on the type of deployment and with advance feature you have the abilitity of profiling and posturing which provide very good control for admins in the network
Software Packages
Options
Base
Capabilities: Basic network access and guest access
Network deployment support: Wired, wireless, and VPN
License prerequisite: None
Perpetual license
Licenses are available for 100, 250, 500, 1000, 1500, 2500, 3500, 5000, 10,000, 25,000, 50,000, and 100,000 endpoints
Advanced
Capabilities: Profiler and feed service, posture, MDM integration, automated endpoint onboarding, and Security Group Access (SGA)
Network deployment support: Wired, wireless, and VPN
License prerequisite: Base license
Term license: 1, 3- and 5-year terms
Licenses are available for 100, 250, 500, 1000, 1500, 2500, 3500, 5000, 10,000, 25,000, 50,000, and 100,000 endpoints
Wireless
Capabilities: Basic network access, guest access, profiler, posture, and SGA
Network deployment support: Wireless
License prerequisite: None
Term license: 1, 3- and 5-year terms
Licenses are available for 100, 250, 500, 1000, 1500, 2500, 3500, 5000, 10,000, 25,000, 50,000, and 100,000 endpoints
Wireless Upgrade
Capabilities: Basic network access, guest access, profiler, posture, and SGA
Network deployment support: Wired, wireless, and VPN
License prerequisite: Wireless license
Term license: 1, 3- and 5-year terms
Upgrade licenses are available for 100, 250, 500, 1000, 1500, 2500, 3500, 5000, 10,000, 25,000, 50,000, and 100,000 endpoints
***Do rate Hekofuls posts***

Difference between ACS and ISE

What is the big difference between the ACS and the ISE? We just purchased an ACS server to start locking down ports on our switches and use the Radius functions to better secure our wireless environment. It has been ordered but not yet arrived. I had a discussion with management today about preventing the IPads / IPhones / Smartphones / etc. of the world from accessing the network. If the user knows the credentials for getting their laptop onto the network then they can use these same credentials to get their IPad on the network. How do we detect and prevent is the current question.
In discussing with others the ISE comes up. The questions now become what is the big difference between this and the ACS. Do they work together or independently since they both seem to have "radius on steroids". Can I configure the ACS to do the same functions? I figure this will have to be something on a MAC address level anyway. Oh and one other thing. My wireless infrastructure is not Cisco.
Off to continue the research path ....
Brent

To put it simply I usually say ACS = RADIUS, ISE = NAC.
ISE will do RADIUS functions as well as NAC functions. Eventually you'll probably see ACS go away and be simply replaced by ISE.
ISE will do posturizing and profiling of a device to see if it truly meets requirements to be on a certain VLAN. For your example if you were to my credentials on my own smart device I would have access. ISE could profile this device to see if it truly is a corporate owned device or not. If it wasn't ISE can switch the network that the device connects to, say a guest network.
ISE can also do captive web portals for wired/wireless guest access.
I wouldn't rely on any type of MAC address authentication as I can easily spoof that.

ACS VM version migration to ISE

Hi,
If a customer bought ACS on VMWare (2 x LCSACS-51-VM) in the past and are interested in migrating to ISE. They would like to consider moving 1 x LCSACS-51-VM to a similar VM based image and the other to an appliance based system. Both act as a redundant pair.
The ordering guide seems unclear on how to handle this scenario. The customer has an SAS support contract.

Have you already gone through this guide.
http://www.cisco.com/en/US/docs/security/ise/1.1/migration_guide/ise_mig_undst_tool.html#wp1027036
Should you've any specific questions regarding migration from ACS 5.x to ISE 1.x, let us know.
~BR
Jatin Katyal
**Do rate helpful posts**

ACS 1121 to ISE migration

Hello ALL,
we have ACS 1121 and are planning to migrate to ISE let me know if its possible if yes what are the license i need to buy

Existing NAC and ACS customers with active support contracts on older appliances are entitled to all of the ISE appliance migration SKUs. Given all the potential appliances migration options (NAC 3140 to ISE 3395, ACS 1120 to ISE 3315, NAC 3310 to ISE VM, etc) PMBU decided to not put any restriction on which migration appliances SKUs customers can use. PMBU is not offering credit for older hardware because the focus is on reduced Base or free Advanced migration licenses.

ACS to ISE

I learned today in my ACS 5.x course of an ISE module that would allow an ACS appliance 5.x that would convert, if that is the right word, the ACS appliance to ISE. Is this correct? is there more information about this?

You can upgrade Cisco ISE from a previous release or maintenance release to Release 1.2. You can also migrate from Cisco Secure Access Control System (ACS), Release 5.3, to Release 1.2.
You cannot migrate to Release 1.2 from Cisco Secure ACS 4.x or earlier versions, Cisco Secure ACS 5.1 or 5.2, or from Cisco Network Admission Control (NAC) Appliance.
You can directly migrate to Cisco ISE, Release 1.2 only from Cisco Secure ACS, Release 5.3. From Cisco Secure ACS, Releases 4.x, 5.1, and 5.2, you must upgrade to ACS, Release 5.3 and then migrate to Cisco ISE, Release 1.2.
Please check the below links which can give your better understanding:
http://www.cisco.com/en/US/docs/security/ise/1.2/upgrade_guide/b_ise_upgrade_guide_preface_00.html

ACS 5.3 Migration Utility Failures

I'm trying to run the migration utility to export from ACS 4.2.0(124) to an ACS 5.3 appliance, and am receiving the "
Fatal Error !! - cannot connect to ACS 4.x DB !!" error when I run the utility on the migration machine. The migration machine has ACS 4.2.0(124) installed and is a Windows 2008 Standard Server SP1 running as a VM. I am logging into the server with VNC (*not* RDP) with a locally-defined administrator account. I get these errors in migration.log when I run the utility and try to do an "analyze and export" function:
07-26-2012 13:36:55 JavaUtils.isAttachmentSupported(JavaUtils.java:1308) WARN - Unable to find required classes (javax.activation.DataHandler and javax.mail.internet.MimeMultipart). Attachment support is disabled.
07-26-2012 13:37:14 ACS4Connector.checkDBConnectivity(ACS4Connector.java:137)FATAL - Fatal Error !! - cannot connect to ACS 4.x DB !!
java.sql.SQLException: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
at ianywhere.ml.jdbcodbc.IDriver.makeODBCConnection(Native Method)
at ianywhere.ml.jdbcodbc.IDriver.connect(IDriver.java:354)
at java.sql.DriverManager.getConnection(Unknown Source)
at java.sql.DriverManager.getConnection(Unknown Source)
at com.cisco.nm.acs.mgmt.migration.ACS4Connector.getConnecter(ACS4Connector.java:66)
at com.cisco.nm.acs.mgmt.migration.ACS4Connector.checkDBConnectivity(ACS4Connector.java:133)
at com.cisco.nm.acs.mgmt.migration.MigrationApplicationCLI.runExport(MigrationApplicationCLI.java:605)
at com.cisco.nm.acs.mgmt.migration.MigrationApplicationCLI.main(MigrationApplicationCLI.java:266)
Any ideas?

Hi there,
The migration utility doesn't work when running Windows 2008 or 64-bits machines. This is already documented:
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtn17779
Let me know if it helps.

Cisco ISE migration from VM to SNS 3415 Appliance

HI Experts,
My customer is running a ISE VM ( os is 1.1.1 ) with base license used only for guest authentication . As per the requirement we need to migrate the existing setup to the ISE hardware (1.2 ).
Can anyone please help me in the best way to do .
I am planning to install a new ISE setup rather than migration but confused regarding the ISE Licensing .
Thanks in advance
Regards
Agnus

Angus,
First and foremost, you must have a current, non-expired license.
The best way to accomplish this is to log in to the Licensing Portal:
https://tools.cisco.com/SWIFT/LicensingUI/Quickstart#
Click on Licenses. Choose the license you would like top transfer to the new 3415 Appliance.
Note that I have selected two licenses, Base and Advanced. You can only select ONE LICENSE at a time. To Re-Host a Base and an Advanced License, you must do this twice.
Then click Actions > Rehost/Transfer...
A new window will appear requesting the information from your new 3415 Appliance (you must have already installed ISE on the appliance):
You can find this information on the new 3415 by going to Administration > Licensing and clicking on the name of your node.
This is all found in the ISE Admin Guide.
http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_0111.html#concept_E664BCA9F4164C7F8DE590B7C2C4AD99
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

ACS vs ISE

Hi experts,
I'm looking into a network access control solution, and I have the following questions:
1- My understanding is that ACS assigns unauthorized assets to a guest vlan/zone, but what happens next if access to resources (such as internet) requires authentication? In other words, does an ACS-only solution imply manual guest access provisioning, as opposed to automatic provisioning with an overlay NAC Guest server?
2- Captive portal vs. Webauth: My understanding is that ACS alone does not provide a captive portal for guests. It only provides a webauth feature that is mainly a fallback authentication mechanism for employees/managed assets, not guests/unmanaged assets. Is this correct?
3- Finally, the Trustsec v2.00 document (http://www.cisco.com/en/US/docs/solutions/Enterprise/Security/TrustSec_2.0/trustsec_2.0_dig.pdf) mentions “Cisco TrustSec 2.0 adds support for Wireless user access. With Cisco TrustSec 2.0, Cisco ISE provides the same authentication methods regardless of user access methods, which could be from wired line or Wi-Fi connection”. Does this mean that ACS has limitations to support wireless connections?
Thank you,
-Mohamad.

1. Wrong understanding. ACS does what you tell it to do. It can assign a guest vlan to unknown assets or assign whatever else you like.
What do you mean with an internet access requiring authentication ? If you think about a guest portal, i.e. a web page asking to enter credentials, then ACS doesn't do that, so you have to couple ACS with a Guest Server. That's a bit of a pity because the Guest Server is not a product that will evolve. ISE just do everything in 1.
2. ACS is not a captive portal correct. When you say "it provides a webauth feature that is fallback", it's wrong. ACS doesn't provide anything like that. The switches implement web authentication (or the wireless controllers) and ACS can authenticate the people using that, but ACS is just a radius server saying "yes/no" and giving privileges.
3.ACS has no limitations to support wireless in particular. What the paper says is that ISE provides a captive portal that will be the same for wired or wireless users.
Remember that with ACS, you need to use the captive portal of the switch and WLC or a nac guest server. So not unified.

Cisco ACS 4.2 migration to ACS 5.4 advice

Hello all, we are planning migrating off our ACS 4.2.0.124 ( non appliance ) to ACS 5.4. I'm looking for any advice or tips from anyone that has done the migration.
Is the migration tool intrusive or can it be run at anytime?
I thought about not using the migration tool and do a new install however we have a few hundred MAC address entered for a Mac authenticated SSID as well as about a 100 switches and routers for TACACS.
We have about a half dozen WIreless Controllers that use AAA with a mix of SSID's that are doing WPA2 with Mac authentication, LEAP, and, PEAP. We also use TACACS for routers and switches and AAA for anyconnect users.
Any advice on the migration process would be appreciated.
Thanks,
Dan

Actually I managed to copy/paste from the ACS4.2 to the CSV file. The passwords will not be imported though so you have to reset the password for all users and let them change it.
If I were you I would have use the import utility to migrate users to keep the password then I will update the information of users (including group membership) via update template CSV file.
The migration I used before included few users that I could create on the spot and ask them to reset the password. Most of the data were MAC addresses for MAC auth and IP addresses for TACACS+ AAA clients (switches, routers...etc).
If you have too many users then the migration tool is your friend to get them imported without having to reset the password.
It is also important that you read the migration guide before you use the utility. You'll find valuable information about what will be imported and how. What data will be maintained and what will not.
HTH
Amjad
Rating useful replies is more useful than saying "Thank you"

ACS 2.4 migration to 3.x?

Hello,
Has anyone migrated from ACS 2.4 to 3.x? If not, how else can you one get data from that version into the next?
thanks!

If you can get hold of the intermediate install images such as 2.6, 3.0 etc all you'd need do is keep installing one over the other. In fact you could go 2.4 direct to 3.0 or even 3.1. Its around 3.2 or 3.3 that the installers starting getting picky about what they would upgrade from.
Remember all the group/user config can be dumped with csutil and re-imported into newer versions - but that doesnt include ACS admin config and the network config database.

ACS to ISE migration

Similar Messages

Maybe you are looking for